Authenticated SSRF via client session host substitution

SSRF in Red Hat Keycloak products allows remote authenticated users to issue server-side HTTP requests via crafted refresh token requests. The OIDC token endpoint stores attacker-controlled client_session_host data, then substitutes that value through application.session.host into a backchannel logout URL that Keycloak contacts with an HTTP POST. Exploitation requires valid credentials, a client configured with that placeholder, and a logout event; requests originate inside the server network and can reach internal services.